TABLE OF CONTENTS I. INTRODUCTION AND THE "RIGHT TO BE FORGOTTEN" PROBLEM II. THE EU PROPOSED REGULATION A. Consent B. Transparency C. Right to be Forgotten D. International Data Transfers E. European Data Protection Board F. Sanctions III. AMERICA'S TARNISHING ABSOLUTISM A. The Rule of Sullivan B. The Rule 0f Daily Mail C. New Rule of American Privacy IV. RECONSTRUCTING PRIVACY V. CONCLUSION I. INTRODUCTION AND THE "RIGHT TO BE FORGOTTEN" PROBLEM
The European Union fired the first shot this year in what pundits are sizing up as a new front in the trans-Atlantic war over the right to privacy. A proposed regulation (1) is likely to become law in some form in the 27-member European Union, and it will supersede the 1995 Data Protection Directive (DPD). (2) The new regulation substantially increases burdens on data handlers, (3) enhancing reporting requirements, toughening the expectation of explicit personal consent to the use of personal data, and giving data subjects more control over their information through rights of revocation and, the flashpoint of intercontinental controversy, the "right to be forgotten." Most importantly, the regulation as proposed would sweep within its ambit for the first time foreign actors who do business in the European Union. Critics, especially in the United States, forewarn of inevitable collision between EU privacy and the U.S. First Amendment. (4)
The simple picture of irreconcilable conflict across the Atlantic conceals nuances on both sides. An observer of American constitutional law from a comparative perspective is impressed on the one hand by the free speech imperative of the First Amendment, of which the firm rule against prior restraint is a part. The imperative posits free speech as the presumptive winner when it comes into conflict with other interests, such as statutory prohibitions, or even with other constitutional rights. (5) To lose out, the free speech claim must be rebutted by countervailing interests, few of which can measure up. (6)
The observer is impressed on the other hand by the weak development in American constitutional law of rights of personality, including reputation and privacy. Lacking the full constitutional gravitas of free speech, these "rights" fare poorly when they run up against the American free speech imperative.
Throw into the mix the American affection for laissez faire economic regulation, and the conflict between privacy in Europe and free speech in the United States starts to come into focus. Even supposing that U.S. lawmakers were inclined to regulate the commercial information marketplace, rules that preclude the dissemination of lawfully obtained, truthful information run headlong into the free speech imperative and the rule against prior restraints. The controverted commercial speech doctrine offers some room for an information-regulatory regime in the United States, subject to an intermediate constitutional scrutiny. But the EU system is not confined to the commercial context.
The "right to be forgotten" is one small part of the proposed EU regulation, (7) but it exposes the crux of the problem. Under the proposal, a person may demand the removal of personal information from data processing and dissemination. (8) Prohibiting the subsequent dissemination of truthful information, lawfully obtained, defies the American free speech imperative. Worse from the American perspective, the rebutting privacy claim is not necessarily even an interest of constitutional magnitude. Any reasonably identifying information triggers the EU regulatory framework, (9) because the broader right of personality animates the regulation, not the narrower American conception of privacy in the intimate or "highly offensive." (10)
A recent European case against Google is illustrative. (11) Alfacs Vacances, S.L., operates a campground in Spain at which a horrific propane-truck accident in 1978 incinerated 160 persons and gravely wounded 300 more. (12) Alfacs complained that searches on Google Spain (www.google.es) for the campground in 2005 called up firstly pictures of the blackened corpses with accompanying graphic descriptions of the tragedy, not to mention reports of persistent paranormal reverberations. (13) Alfacs submitted that its business reputation was impugned and customers lost to the tune of 300,000 [euro] in damages. (14) Google asserted a free speech interest in its links and in the ordering of search results. (15) But more importantly, Google Spain, S.L., the respondent within the personal jurisdiction of Spanish authorities, professed that it has no authority or ability to operate the Google search engine, which is administered by the corporate entity Google, Inc., in the United States. (16) A Spanish trial court agreed that Alfacs had sued the wrong party. (17)
Though the Alfacs case arose in the trial court as a claim of corporate reputational injury, the facts mirror a pattern in more than 100 pending claims (18) before the Spanish data protection authority. (19) Spanish law, unexceptionally in the European Union, goes beyond the barest requirements of the DPD, if not as far as the proposed regulation, to afford claimants a right to be forgotten, or to erasure. (20) These claims keep Google counsel up at night. (21) A person might employ the right to be forgotten to demand that Google purge from its data stores any identifying information to which the person objects--an unfavorable review of services or an embarrassing photo, regardless of truth, of previous consensual disclosure, or third-party content creator. Under the proposed regulation, domestic European authorities could bring Google, Inc. (U.S.) within reach of EU data protection enforcement (provided long-arm jurisdiction in domestic law (22)), because Google, Inc., provides its services to EU citizens. (23) Under data protection legislation, Google could face remedies that it would regard as censorship, including correction and redaction. Notwithstanding enforcement against a respondent's EU assets, an injunction against technological operations in the United States would set up a classic confrontation of foreign-judgment enforcement and First Amendment values. (24)
In fact, the nightmare scenario already has unfolded. Google and Yahoo in Argentina successfully battled defamation (or moral harm) claims over search results that led users to sexually provocative content regarding entertainer Virginia da Cunha. (25) While the two services were exonerated of having themselves defamed da Cunha, the underlying content that she found offensive continues to be legally problematic. The appellate court rejected the defamation claim because Google and Yahoo lacked actual knowledge of the defamatory content, (26) a defense that only works once. (27) Google has maintained that it cannot redact specific items from its search returns for da Cunha, (28) and its Argentine search engine has continued to return controverted content. (29) So Google might still be on the hook. Yahoo's Argentine search engine meanwhile returns no data upon a search for da Cunha, rather an Orwellian message that search results are suspended by court order. (30) Moreover, da Cunha's case is not unique. The New York Times reported in August 2010 that more than 130 similar cases, including one by football star Diego Maradona, (31) were pending in Argentine courts. (32) Cases such as these lead constitutional law experts such as Professor Jeffrey Rosen to conclude that the effect of the EU regulation will be to diminish the range of information freely available to the world via the Internet. (33)
There is, however, a dynamic on the United States' side of the equation that has not been well explored in the literature. While media and free speech advocates foretell a grave threat, (34) it might be that the American value threatened is not so hallowed after all. Underlying the free speech position is the assumption that the free speech imperative and its sacrosanct rule against prior restraints represent axiomatic American values. That might not be true.
Contemporary free speech law in the United States, especially in areas of tort and criminal defense, was shaped dramatically by the civil rights movement. The doctrines that emerged from that era undoubtedly made crucial innovations in furtherance of fundamental human rights in the United States and around the world. But in some cases, the constitutional jurists might have reached too far--over-protecting interests such as free speech without fully considering the implications for competing interests. Technologies such as the Internet and social developments such as the 24/7 news appetite furthermore have changed the game in unforeseen ways. An American ethos in which free speech is king and rights of personality are relatively marginal was once axiomatic; now, with countervailing forces in play, that axiom is fissuring.
Free speech and media advocates might or might not be justified in their fears about the implications of EU privacy for the flow of information in the world. The purpose of this Article is not to adjudicate that question, but to posit an ancillary thesis: that the proposed EU regulation is a better reflection of already extant U.S. norms than media advocates would care to say; and therefore, American privacy norms already are moving in the direction of Europe's. The Atlantic divide that is often imagined as a collision of tides moving in opposite directions might instead be a convergence of waves moving the same way.
The following Part II examines summarily the proposed EU regulation, especially with respect to the "right to be forgotten," to facilitate understanding of issues and objections. Part III examines the U.S. coastline, highlighting promontories in information and free expression law that reveal a less-than-monolithic commitment to EU-contrary principles often presumed to be axiomatically American. Part IV briefly engages recent...